CVE-2023-6063

HIGH NUCLEI

WordPress WP Fastest Cache Unauthenticated SQLi (CVE-2023-6063)

Title source: metasploit
STIX 2.1

Exploitation Summary

EIP tracks 6 public exploits for CVE-2023-6063. PoCs published by motikan2010, Eulex0x, incommatose, including Metasploit module auxiliary/scanner/http/wp_fastest_cache_sqli. A Nuclei detection template is also available.

AI-analyzed exploit summary This PoC demonstrates an unauthenticated SQL injection vulnerability in WP Fastest Cache via the 'wordpress_logged_in' cookie parameter. It uses sqlmap to exploit the vulnerability and dump database schema.

Description

The WP Fastest Cache WordPress plugin before 1.2.2 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users.

Exploits (6)

nomisec WORKING POC 29 stars
by motikan2010 · poc
https://github.com/motikan2010/CVE-2023-6063-PoC

This PoC demonstrates an unauthenticated SQL injection vulnerability in WP Fastest Cache via the 'wordpress_logged_in' cookie parameter. It uses sqlmap to exploit the vulnerability and dump database schema.

Classification
Working Poc 90%
Attack Type
Sqli
Complexity
Trivial
Reliability
Reliable
Target: WP Fastest Cache < 1.2.2
No auth needed
Prerequisites: WP Fastest Cache plugin enabled · Access to the target WordPress site
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC 9 stars
by Eulex0x · poc
https://github.com/Eulex0x/CVE-2023-6063

This repository provides a proof-of-concept for CVE-2023-6063, an unauthenticated SQL injection vulnerability in WP Fastest Cache plugin. The exploit leverages the 'wordpress_logged_in' cookie parameter to perform SQL injection attacks using sqlmap.

Classification
Working Poc 90%
Attack Type
Sqli
Complexity
Trivial
Reliability
Reliable
Target: WP Fastest Cache < 1.2.2
No auth needed
Prerequisites: WP Fastest Cache plugin enabled · Access to the target WordPress login page
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC 1 stars
by incommatose · poc
https://github.com/incommatose/CVE-2023-6063-PoC

This repository contains a functional Python-based PoC for CVE-2023-6063, a time-based blind SQL injection vulnerability in WP Fastest Cache ≤1.2.2. The exploit extracts password hashes and emails from the `wp_users` table via crafted `wordpress_logged_in` cookie payloads.

Classification
Working Poc 95%
Attack Type
Sqli
Complexity
Moderate
Reliability
Reliable
Target: WP Fastest Cache (WordPress Plugin) ≤1.2.2
No auth needed
Prerequisites: Target running WP Fastest Cache ≤1.2.2 · Network access to the WordPress site
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WRITEUP
by hackersroot · poc
https://github.com/hackersroot/CVE-2023-6063-PoC

This repository contains a README describing an SQL Injection vulnerability in WP Fastest Cache (CVE-2023-6063). No actual exploit code or proof-of-concept is provided.

Classification
Writeup 90%
Attack Type
Sqli
Complexity
Theoretical
Reliability
Theoretical
Target: WP Fastest Cache (version not specified)
No auth needed
Prerequisites: Target running vulnerable version of WP Fastest Cache
devstral-2 · analyzed Feb 16, 2026 Full analysis →
inthewild WORKING POC
poc
https://github.com/thesafdari/cve-2023-6063

This repository provides a functional PoC for CVE-2023-6063, an unauthenticated SQL injection vulnerability in WP Fastest Cache 1.2.2. The exploit leverages the 'wordpress_logged_in' cookie parameter to inject SQL queries, demonstrated using sqlmap.

Classification
Working Poc 90%
Attack Type
Sqli
Complexity
Trivial
Reliability
Reliable
Target: WP Fastest Cache 1.2.2
No auth needed
Prerequisites: WP Fastest Cache plugin enabled · Access to the target WordPress site
devstral-2 · analyzed Feb 23, 2026 Full analysis →
metasploit WORKING POC
by Valentin Lobstein, Julien Voisin, Alex Sanford · rubypoc
https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/scanner/http/wp_fastest_cache_sqli.rb

This Metasploit module exploits an unauthenticated SQL injection vulnerability in WordPress WP Fastest Cache via the 'wordpress_logged_in' cookie. It performs a time-based blind SQL injection to retrieve user credentials from the database.

Classification
Working Poc 95%
Attack Type
Sqli
Complexity
Moderate
Reliability
Reliable
Target: WordPress WP Fastest Cache < 1.2.2
No auth needed
Prerequisites: Target running vulnerable version of WP Fastest Cache · Access to the WordPress admin path
devstral-2 · analyzed Feb 16, 2026 Full analysis →

Nuclei Templates (1)

WP Fastest Cache 1.2.2 - SQL Injection
HIGHby DhiyaneshDK
Shodan: http.html:/wp-content/plugins/wp-fastest-cache/
FOFA: body=/wp-content/plugins/wp-fastest-cache/

References (2)

Core 2
Core References
Exploit, Third Party Advisory exploit vdb-entry technical-description
https://wpscan.com/vulnerability/30a74105-8ade-4198-abe2-1c6f2967443e

Scores

CVSS v3 7.5
EPSS 0.9137
EPSS Percentile 99.7%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Details

CWE
CWE-89
Status published
Products (1)
wpfastestcache/wp_fastest_cache < 1.2.2
Published Dec 04, 2023
Tracked Since Feb 18, 2026